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® 
THIS SOFTWARE IS FURNISHED UNDER A LICENSE AND MAY BE USED AND COPIED + 
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INCLUSION GF THE ABOVE COPYRIGHT NOTICE. THIS SOFTWARE OR “ANY OTHER 
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THE INFORMATION IN THIS SOFTWARE IS SUBJECT TO i elel WITHOUT NOTICE 
ND SHOULD NOT BE CONSTRUED AS A COMMITMENT BY DIGIT ITAL EQUIPMENT 


A 
CORPORATION. 


DIGITAL ASSUMES NO RESPONS af ITY FOR THE USE OR RELIABILITY OF ITS 
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SOFTWARE ON EQUIPMENT WHICH IS NOT SUPPLIED BY DIGITAL. 
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; Facility: Executive 

Abstract 

: This module contains the centralized Security Auditing routines. 


; Enviornment: 
VMS Paged Exec - Kernel mode 


: ; Author: 
R. Scott Hanna, CREATION DATE: 04-Mar-1983 
; Modified by: 


v03-009 ACG0425 Andrew C. Goldstein, 27-Apr-1984 11:06 
Move code to a B posed psect (and fix up the one leg 
at elevated IPL 


v03-008 MHB0119 Mark Bramhall 26-Mar-1984 
Support mandatory auditing flag NSA$x_ARG_FLAG_MANDY. 
Have mandatory auditing imply alarm for now. 


v03-007 Spates R. Scott Hanna 28-Feb-1984 
hange time field in security auditing record header 
ee a longword to a quadword. 


v03-006 jpeeten Scot Henne 01-Feb-1984 
Changes for tietd’ test 
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v03-005 pewoure R. Scott Hanna 06-0c t-1983 
gnge journal name and access mode. ELiminace PROT and 
ets keywords from SASSJNL_S. 
V03-004 RSHO066 R. Scott Hanna 15-Sep-1983 
Fix problem in ALARM. FORMAT "PILACC. 
v03-003 RSHO061 Scote Hanna 06-Sep-1983 
Modi fy PRVSKEYWORD routin 


e to not return y toe length. 
Remove trailing CRLF from alarm messages. C 

BUILD_RECORD -p PKT to reference field $ ze as : were 

Changé ALARM-RECORD to set SECURITY privilege in 

message header. Fix 5 + acy in ALARM_FORMAT oF RVSK. 4 
to bogus 2 seimeg 


V03-002 RSHO04S Scott Ba ona -1983 
Replace tem orary OPCSM NM OPER1 and ih Ra~ URas? with 
OPCSM_NM_SECURITY and OPC$_RQ_SECURITY 


V03-001 RSHOO38 R. Sco 17-Jun-1983 
Make chenges due to the * sdaition of NSASL_ARG_COUNT in 
SNSAARGDEF. 
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Declarations and Assumptions SEP=- SYS.SRCJSECAUDI ’ 3) 04 


T.MAR; 1 Vv 


; -SBTTL Declarations and Assumptions 
: Define Symbols 
8 SDSCDEF : Arquaent descriptor defs 
SIPLDEF ; Priority defs 
0 SJIBDEF ; Job Information Block defs 
91 SMSGDEF ; Operator message defs 
35 SNSAARGDEF ; Auditing argument List defs 
00 9 SNSAIDTDEF ; Auditing impure data table defs 
4 SNSARECDEF ; Auditing record defs 
5 SOPCDEF ; Operator class defs 
8 $ SPCBDEF : Process control block defs 
SPROEF ; Processor register defs 
8 3 98 SPRVDEF ; Privilege bits defs 
99 SPSLDEF ; Processor status longword defs 
0 8 100 SRSNDEF ; Resource wait defs 
0 101 SSBDEF ; SCS System Block defs 
: 8 ! ¢ SSSDEF ; System service defs 
444 194 ; Minimum size in record to allow insertion of another packet 
00000010 0000 196 REC_MIN_SIZE_LEFT = NSASK_PKTHDR_LENGTH*4 
$3331 
0000 109 
44 BF ASSUME NSASK_REC_MAXLENGTH LE NSAS$S_IDT_RECORD_BUF 
0000 We ; All code is pageable. 
0000 11 
00000000 114 -PSECT YSEXEPAGED 


; Make sure that the largest record will fit in the buffer 
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Maret NSASEVENT AUDIT - Event Auditing Routine ety 7 83:19:24 SYS.SRCJSECAUDIT.MAR;1 - dh v04 
116 »SBTTL NSASEVENT_AUDIT = Event Auditing Routine 
1 ; NSASEVENT_AUDIT = Event Auditing Routine 
FUNCTIONAL DESCRIPTION: 
1 : This routine is called when an auditable oyyces event occurs. It 
125 ; takes the data in the argument List and builds the journal record. 
1246 ; The record is then written to the security audit Journal and/or 
} 5 : sent to OPCOM to print a security alarm message. 
1 5 : This routine must be called in KERNEL mode at IPL 0 in the context 
° : 8 : of the process which caused the event being audited. 
20 130 : CALLING SEQUENCE: 
00 : ; CALLS or CALLG to NSASEVENT_AUDIT 
909 4 : INPUTS: 
$00 1 § : AP = Pointer to the event acgyment List. Event argument lists are 
+4 : , ; defined by the SNSAARGDEF macro. 
999 139 > OUTPUT: 
44 141 : RO = status of operation 
00 196 : R1 = Destroyed 
aie 
OFFC 000 145 -ENTRY NSASEVENT_ AUDIT, “M<R2,R3,R4,R5,R6,R7,R8,R9,R10,R11> 
56 00000000'9F 43 Ons 146 MOVAL a@#NSAST_IBT,R6 ; Get yoguee data block pointer 
57 00000000'GF 1) 00 14 MOVL G*SCHSGC_CURPCB,R7 3; Get PC 
3 01 oO 001 148 MOVL #1 aPSL$C_KERNEL,-(SP) ; Assume kernel ast's enabled 
02 ODA 00 €4 001 149 BBSC #PSLSC_KERNEL,PCBSB_ASTEN(R7),1$ ; Br if kernel ast's enabled 
D4 1 150 CLRL 3; Kernel ast's were not enabled 
10 1A =151 «18: BSBB BUILD_RECORD_DT ; Build the record descriptor table 
58 01 00 1C 13 MOVL g : Init record number 
59 0437 C6 43 7 °3s MOVAL NSAST_IDT RECORD_DT+1(R6) ,RO ; Get record descr table pointer 
0081 024 154 2$ BSBW BUILD REC ; Build the record 
01 €1 0027 #155 BBC #NSASV_ARG_FLAG_JOURN,- ; Br if this record is 
06 08 AC 029 1 § NSASB_ARG_FLAG(AP) ,3$ 3 «.-not to be journaled 
o118 30 O002C 1 BSBW JOURNAL _RECORD ; Journal the record 
17 5 53 ek 8 BLBC -5$ : Br if error 
159 3$: BITB #<NSASM_ARG_FLAG_ALARM! - ; Alarm and/or 
160 NSASM_ARG_FLAG_MANDY>,=- 3; mandatory audit 
08 AC 5 161 NSASB_ARG_FCAG(AP) : _ for this record? 
| $ 166 BEQL : ; Br if neither 
01 16 BSBW ALARM_RECORD ; Alarm the record 
96 50 3 164 BLBC RO,5$ : Br if error 
FFDE 58 01 96 6 ‘6 165 4$: ACBB NSAST_IDT RECORD OT (RG) .#1 R828 ;_Br if more records 
9 1 " 4 166 MOVL #SS$_RORMAL ,R ; Return success ; 
OD A 6E Rep He 5$: Biss (SP) 7PCB$B_ASTEN(R7) ; Restore kernel ast enable bit 
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v5s-800 Record building routines mist 84:19:24 SYS.SRCISECAUDIT.MAR;1 _ (ay 
| 1? -SBTTL Record building routines 
aE 7 ; BUILD_RECORD_DT - Build the record descriptor table 
aE 17 ; FUNCTIONAL DESCRIPTION: 
| 178 ; This routine builds the record descriptor table. 
ae 178 : INPUTS: 
4E 180; R6 = Impure data block pointer 
iE ! : AP = Pointer to the event argument List. 
4E 183 > OUTPUT: 
dE 5 ; NSAST_IDT_RECORD_DT(R6) = The record descriptor table 
ot Ht ; RO-R4,R9-R11 = Destroyed 
4E 189 ° 
Bate 190 BUILD_RECORD DT: 
51 0437 C6 ODE pee 191 MOVAC NSAST_IDT_RECORD_DT+1(R6) ,R1 ; Init packet pointer 
FF Al O01 00 3 136 MOVL #1,-1TR1) ; Init rec count, flgs. & pkt count 
54 09 AC 9A 0057 19 MOVZBL NSASB_ARG_PKTNUM(AP) ,R4 : Get total number of packets 
4—E 13 0058 194 BEQLU 7 ; Br if none (header only) 
53 OC AC oF 05D 195 MOVAL NSAST_ARG_LIST(AP),R3 ; Init arglist pointer 
49 «1 061 196 BSBB GETNEXT PRT 3; Get first pkt type, size, addr 
ieee pee 19 BRB $ ; Init first record 
45 10 006 198 1$: BSBB GET_NEXT_PKT ; Get next pkt type, size, addr 
50 o% C2 0067 199 2$: SUBL #NSASK_PRTHDR_LENGTH,RO ; Subtract out packet header size 
50 A D1 Q06A 00 CMPL R10,R0 ; Will packet fit in current rec? 
13. 15 006d 01 BLEQ ; Br if yes 
10 50 01 of § CMPL RO,#REC_MIN_SIZE_LEFT ; Put part of pkt in this rec? 
4 19 2 BLSS 4$ ; Br if no 
7E «8658 > 74 4 ADDL RO,R11,-(SP) ; Save remaining address 
7E 3=SA 0 C3 78 05 SUBL RO,R10,-(SP) ; Save remaining size 
SA 0 p00 0oOO07C 86 MOVL 10 ; Size = size left in record 
62 01 9 7F 0 MOVE §$ #NSASM_REC_FLAGS_PKTCON,(R2) ; Indicate packet continuation 
81 9 8B Hi g 3$: MOVW (RIS+ ; Insert pkt type in descr table 
+ A 8B 0 MOVW R10, (R1)+ : Insert size in rec descr table 
1 3 088 10 MOVL R11, (R1 ; Insert addr in rec descr table 
O1A 11 INCB 1(R2) ; Increment packet count 
50 SA 5 E \¢ SUBL Rig RO ; Subtract out packet size 
$¢ 1 TSTB (R25 i: Is curr pat cont in next rec? 
1 9 14 BEQLU 6$ ; Br if no 
. = 9 15 MOVQ (SP)+,R10 ; Get remaining size and address 
0436 ? 36 98 18 4$: INCB NSAST_IDT_RECORD_DT(R6) :; Increment record count 
50 0384 8F C 9C 17 5$: MOVZWL #NSASS_IDT_RECORD_BUF- - ; Init size remaining 
Al 18 NSASK RECHOR_LENGTH.RO 
52 1 00 Al 1 MOVL R1,R2 ; Get new flags byte pointer 
! 84 ng 0 cLRW cnt) : Init flags byte and pkt count 
BA a F5 AB ; gs: SOBGTR R4,1$ ; Br if more packets 
05 AB $: RSB 
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*GET_NEXT_PKT - Get next data packet information 
; FUNCTIONAL DESCRIPTION: 


This routine returns the type, size, and data address of the next 


packet to be placed in the record. 
R3 = arglist pointer 


R3 = updated — pointer 


% ee 
ddress of packet data 


: —— 


Get packet type 
; Get anes cessing mechanism 
ne arg passing mechanism 


; Descriptor 


; Value 4 
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: Address o" Seger tpter 
= size 
= address 
Round sie up to next longword 


Point to next argument 
Get size and addr from descr 


Get size and addr from descr 
Convert first longword to size 


H 7 
sein ret ies ree NCSEEBE GLE) UNCUMECSECRANDE RP 


R9 = Updated record descriptor table pointer 
NSAST_IDT_RECORD_BUF(R6) = Record 


o 
=] 
co 


D 3 3 ++ 

3 : BUILD_RECORD = Build a record 

b : FUNCTIONAL DESCRIPTION: 

p : This routine builds a record 
OD : INPUTS: 
OD ; Rg = Im ure. te block pointer 
OD $ = PCB pointer 

D 3 Re = Record sequence number 
iH : = Record descriptor table pointer 
00D : OUTPUT: 

B 


oo 
OOOO 0000009090909 09 COO NI NINN NINA OAOAOAO 
FAN OOO NA WENN 9 OO NAME WI OOONOAUNE 


woo 
Ww 


time 
MOVAB GasCSSGA. “LOCALSB+SBS$T _NODENAME , Ri ; set, node name ASCIC pointer 
MOVZBL (R1)+,RO™ bet size 
MOV RO, (RI) ,#°X20 #SBSS _NODENAME , R35; Insert node na 


: RO-R5,R10-R11 = Destroyed 
D 
D UILD_RECORD: 
5A  042E C6 7E D MOVAQ NSA$Q_IDT pe cone peste (R6),R10 ; Get record descr _poteter 
53. 2E AG «DE «00D MOVAL NSA$T-IDT"RECORD BUF (R6) ,R3 : Get record addre 
6A O10E004C BF 00 E MOVL #NSASR_RECHOR L AGTH! - ; Init the record "descripter 
E <DSCSK_DTYPE_Tai6>! 
E <DSCS$K~ LASS_ “$a24>, (R10) 
04 AA 53 dO E MOVL 4 (RTO) 
83 04 AC DO OOE MOVL ON KS ARG_ID(AP) ,(R3)+ : Insert record type 
83 58 9 F MOVB RB, (R3)+ ~ ; Insert record sequence number 
83 0436 (6 9 F MOVB NsAsT. IDT_RECORD_DT(R6),(R3)+ |; Insert Last Spquense number 
8 F MOVW (R9) +, (R3T+ : Insert logs byte & pkt count 
xy! 8 F ADDW3 ansasi _PKTHDR_LENGTH, (R10), (R3)+ ; Insert offset to first packet 
4 8B F MOVW #NSASK”- PKTHDR-LENGTH, (R3) + : Insert peree* header size 
me A7 b MOVL PCBSL_EPID(R7J, (RG )+ ; Insert 
0000 ' GF D MOVa G*EXESGQ_SYSTIME, (R3)+ Insert event 
1 
1 
1 
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+ 
39 
98 
99 
0 
1 
9A § 
63 10 20 zt Q gc ¢C 
51 770A 4 VAB  PCBST_LNAME(R?), : bet process name mASCIC pointer 
0 1 QA 5 MOVZBL (R1)+,RO 3; Get size 
as 0 BD 6 0 $f $ vc RO RO on #PCBS Lane es) ; Insert process name 
14 vc #Jiess pesee ERNARE + 1538 -ACCOUNT,= ; Insert Username and Account name 
63 0 ‘OF Osc TL st HSERNAR 
B FF A9 9A MOVZBL <-1(R9),R ; Get number of packets 
11 1 19 BEQLU) 2% : Br if none 
83 9 8B 11 18: OVW (R9)+, (R3)+ : Insert packet type 
63 69 4 A \¢ ADDW #NSASK_PKTHDR_LENGTH,(R9),(R3) ; Insert packet 
A 3 A 1 ADDW (R3)+, TR10) ; Add pac et size to record size 
63 9 2 4 14 vc (R9)+, @(R9)+, (R3) ; Insert field in packe 
EF 58 F 4 13 = SOBGTR ri1,1$ : Br if more packets 
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» SBTTL JOURNAL RECORD = Journal the audit record 
; JOURNAL RECORD = Journal the audit record 
; FUNCTIONAL DESCRIPTION: 


This routine assigns a channel to the secur {sy audit journal, (if it 
has not been assigned already), and writes the event record. 


> INPUTS: 
: R6 = Impure data block pointer 
> OUTPUT: 


RO = Status of operation 
Ri = Destroyed 


NOTE: This routine has been removed. It will be replaced when Journaling is 
; supported. 


JOURNAL _RECORD: 
MOVL —-#SS$_NORMAL ,RO 
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» SBTTL ALARM_RECORD = Generate Security Alarm 
ALARM_RECORD = Generate Security Alarm 
FUNCTIONAL DESCRIPTION: 


INPUTS: 
R 
RY 

OUTPUT: 


RO = status of operation 
R1-R5 = Destroyed 


= Impure data block pointer 
= PCB pointer 


LARM_RECORD: 
MOVAL 


> Se Se Se Se Se Ge Se Se Se Se Se Se SeSe Sees 


NSAST_IDT_ALARM_HDR(R6) ,R3 
#MSGS~OPROST, (R3)+ 


(R 
PRYSy SECURITY GE 32 
(R3)+ 


#<1a<PRVSV SECURITY-32>>, (R3)+ 
PCBSL_UIC(R7), (R3)+ 
#J1B$S_USERNAME+J1B$S_ACCOUNT,- 
QACTLST_USERNAME, (R3) 


C 
MOVZWL NSA$Q_IDT_RECORD_DESCR(R6) ,R3 
ADDL2 #NSASS_IDT_ALARM-HDR,R3 
G*SYSS$GL_OPRMBX,RS 
NSAST_IDT_ALARM_HDR(R6) ,R4 


_ 
bod 
- 


M 
SETIPL 


R »#SSS_MBFUL 


DP ANAAAAAAA.AA AAA NAAN AAA A AAA AANA HAAN ANN AAA AIAN. A AANA MN ANAM 


CDODOOWOWOWO OOOO 090009 0969 09 09 09 09 09 FINN NIN NNN PPA AAA AAD MII 


SOWA ARAN SOD NAME WINS OD NAME WIN O09 ONAN EWI OOD NOUN EWI OOOO NOU 
o 
- 
» 
ec 


ROVZWL #RSNS_MAILBOX, RO 
28: CMPL RO, #SS$_INSFMEM 

BNEQU 

MOVZWL #RSNS_NPDYNMEM,RO 
3$: MOVL  ——R7,R4 

MOVPSL -(§P) 

SETIPL B*5$ 

J58 G°SCHSRUAIT 

BRB $ 
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This routine sends the security audit record to the OPCOM process 


; Get alarm header address 

; Insert message type 

3; No ty mailbox 

; Assume SECURITY in second longword 
; Zero first longword of mask 

: Insert security mask 

3; Insert VIC 

3; Insert Username and Account name 


ro base priority and spare bytes 


(R35) ; Ze 
MOVL #<OPCSM_NM_SECURITY@8+OPCS_RO_SECURITY>, (R )+ ; Insert opcom header 


; Get record size 

3; Add header size 

3; Get UCB addr of operator mailbox 
; Get address of buffer 


#IPLS_ASTBEL Block ast delivery 
; The buffer must be page aligned and LE 3 pages 
ASSUME NSAST_IDT_ALARM_HDR E 
ASSUME NSAS$S_IDT_ALARM_HDR+NSASS_IDT_RECORD_BUF LE _512*3 
CMPL 510(RS) , 1024 (R47 ; Fault in 3 pages 
JSB G*EXESWRTMAILBOX : Write message 
SETIPL + ; Enable ast delivery 
BLBS RO,4$ ; Br_if success 
BBS #PSLS$C_KERNEL ,PCBSB_ASTACT(R7).4$ ; Br if we are in a kernel ast 
CMP L ; Mailbox full? 

r 


3 not 
; Set resource to mailbox full 


Not enough pool? 

Br if some other error 

Set resource to non-paged pool 
R4 = PCB 


Push PSL on stack 
Raise IPL to SYNCH 
Wait for resource 
Try again 


voe-000. 


kK 7 
Ond'= Generate Security Alarm 'S-SEP-1986 OS:ar:40 
$ 1 4$: RSB 
4 g 5$: -LONG IPLS_SYNCH 


SySeSRCISECAUDIT-MaR:1 = 29" 8, 


; Lock between the SETIPL and here 


SHE 
v04 
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»SBTTL Arglist Packet Entry Insertion Routines 


MOVE #NSASK. PKTTY 
NSASK_ARG MER DEScRat6>, (R2)+ 
MOVAL SFCTLSGL _IMGHDRBF ,R 


JSB yas”: Resigamegmndee 


38 
82 00040001 8F 00 
54 Q0000000'9F ODE 
Q0000000'GF 16 

82 3 


Store peees type and passing 
.--mechanism in arglist 

Get address of soaieore that has 
the image header buffer address 
Get the image name 


101 405 
1D1 «406; 
2 c 5 it : NSASARGLST_ IMGNAM = Insert The Argument List Entry For The IMGNAM Packet 
11 ; FUNCTIONAL DESCRIPTION: 
191 a ; This routine inserts the IMGNAM packet entry in the callers arglist. 
101 “i$ ! CALLING SEQUENCE: 
1p 419 ; JSB NSASARGLST_IMGNAM 
1p a1? § ; INPUTS: 
13 a18 : R2 = Pointer to the IMGNAM packet entry in arglist 
101 4 ? OUTPUT: 
ate ? 5 | ; R2 = Pointer to the next packet entry in arglist 
we 
ite 4 5 NSASARGLST_IMGNAM: : 
BB 0101 428 PUSHR #*M<R3,R4,R5 ; Save registers 
0103 429 
Bipe 430 
1DA 431 
OIE 233 
7D O1E7 434 MOVQ Put size and address in arglist 
BA QIEA 435 POPR #°M<R3,R4,R5> Restore registers 
05 O1EC 436 RS 
O1ED 437 
O1ED 438 


SECAUDIT 
Symbol table 


ee 


QOMmMmmnoonon 


NSASK_PKTADR_LENGTH 
NSASK_PKTTYP_IMGNAM 


A 
NSASL ARG 
NSASM_ARG_FLAG_ALARM 


NSAST— 
NSAST~1DT_ALARM_HDR 
NSAST—~1DT~RECORD_BUF 
NSAST~IDT~RECORD~DT 
NSASV~ARG-FLAG JOURN 


PRVSV_SECURITY 
PSLSC~ KERNEL 
REC_MIN_SIZE_LEFT 
RSNS LBOX 


$B 
SCHSGL_CURPCB 
SCHSRWAIT 


= SECURITY AUDITING ROUTINES 
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gteeeceeee 
tererene 
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02 
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SrSEp=1986 83:47:40 


+3 fe c+ LOCALSB gterenee 
SS$_INSFMEM = 0124 
SS$_MBFULL s D8 
$53 NORMAL = 0001 
SYSSGL_OPRMBX eeereree 
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SHE 
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N 7 
SECAUDIT = SECURITY AUDITING ROUTINES 1 mith 9 04: 19:2) Ae at ee , 


Psect synopsis -SEP=1 


deme enoceman emo $ 


! Psect synopsis ! 


tone enw ene ew on ane} 


PSECT name Allocation PSECT No. Attributes 

- ABS . 4444 ( oF 0¢ 0.) NOPIC USR CON ABS LCL NOSHR NOEXE NORD 

SABSS B80 0 ( én 1 ¢ 1.) NOPIC USR CON ABS LCL NOSHR EXE RD 

YSEXEPAGED QOOOOIED (¢ 493.) 2¢ 2.) NOPIC USR CON REL LCL NOSHR EXE 
i ne 
: Performance indicators : 

Phase Page faults CPU Time Elapsed Time 

Initialization 9 0:00:0 96 8:00:01. 7 

ny wichurree- 338 0:00;18.37 0:00:48-8 

Symbol table sort 9° 30:83 “13 8 3 

ass : : e : : . 

Symbol table output $ 80; 8; 11 0:00:00.70 

Psect synopsis output 00:00:00.0 88:85: 00.05 

Cross-reference output Bo 288: 3-2 0:00:00.0 

Assembler run totals 626 0:00:18.4 00:01:04.67 


The working set Limit was 1500 pages. 

74292 bytes (146 pages) of virtual memory were used to buffer the intermediate sgde. 

There were 80 pages of symbol table space allocated to hold 1404 non-local and 23 local symbols. 
source lines were read in Pass 1, producing 17 object records in Pass 2. 

24 pages of virtual memory were used to define 23 macros. 


Macro Library name Macros defined 
“$52 2SDUAZE: ESYS 08 JL1B.MLB;1 

$255S$DUA28: CSYSLIBISTARLET.MLB;2 1 
TOTALS (all Libraries) 2 


1517 GETS were required to define 20 macros. 
There were no errors, warnings or information messages. 
MACRO/LIS=L1S$:SECAUDIT/OBJ=0BJ$:SECAUDIT MSRC$:SECAUDIT/UPDATE=(ENHS$: SECAUDIT) +EXECML$/LIB 
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NOWRT NOVEC BYTE 
WRT NOVEC BYTE 
WRT NOVEC BYTE 
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